Voice communications can be performed between many different types of endpoints and endpoint systems. One communications framework approach enables the use of software-powered telephony, which is a change in paradigm from traditional PBX (private branch exchange) telephony solutions. The user identity is used for all modes of communications and, the telephony components can be provided by the computing system, voice peripherals, and/or dedicated IP phones. This differs from existing PBX solutions that pre-provision a telephone which is not directly tied to a user identity and is not authenticated to a communications server. In a PBX system, the caller ID is tied to a phone that physically connects to that phone line. In a broader sense, this also applies to voice and other modality communications such as instant messaging, data collaboration, etc.
In a unified communications (UC) architecture where some or all forms of communications are integrated, provisioning can be initiated from a UC client that is connected to the Internet, for example, and which can authenticate with a UC server. While enabling greater flexibility in communications, the approach does require greater trust in the user identity, for example, when the receiving party receives caller identification as part of an incoming call. It is possible for a third party to access a user phone or peripheral when unattended and place a call, as is the case with PBX solutions today. Consequently, with existing solutions, the receiving party does not know that the call has not been made by the calling party advertised in the caller ID, and thus, may unintentionally disclose information.
While a user obtaining access to the user phone or peripheral is one type of problem, a broader issue can be where a first user enters credentials of a second user on the first user softphone and then masquerades as the second user. This is possible if the second user credentials/password are weak and then hacked by another person. In the PBX world, physical access to the line or phone is required, whereas in the UC architecture, in addition to access to another user's peripheral/phone, the ability to then hack another password poses a security risk.